PT-2016-3807 · Openstack · Liberty+2

Nathan Kinder · Published 2016-02-03 · Updated 2022-05-13 · CVE-2015-7546

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Identity (Keystone) versions prior to 2015.1.3 OpenStack Identity (Keystone) versions 8.0.x prior to 8.0.2 keystonemiddleware versions prior to 1.5.4 Liberty versions prior to 2.3.3

Description The issue is related to the improper invalidation of authorization tokens when using the PKI or PKIZ token providers. This allows remote authenticated users to bypass intended access restrictions and gain access to cloud resources by manipulating byte fields within a revoked token.

Recommendations For OpenStack Identity (Keystone) versions prior to 2015.1.3, update to version 2015.1.3 or later. For OpenStack Identity (Keystone) versions 8.0.x prior to 8.0.2, update to version 8.0.2 or later. For keystonemiddleware versions prior to 1.5.4, update to version 1.5.4 or later. For Liberty versions prior to 2.3.3, update to version 2.3.3 or later.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2015-7546

GHSA-8C4W-V65P-JVCV

PYSEC-2016-20

Affected Products

Liberty

Openstack Identity

Keystonemiddleware

References · 19

• https://security.openstack.org/ossa/OSSA-2016-005.html · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2016-20 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-7546 · Security Note
• https://wiki.openstack.org/wiki/OSSN/OSSN-0062 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-7546 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8c4w-v65p-jvcv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-7546 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2015-7546 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-7546 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-7546 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-7546 · Vendor Advisory
• https://github.com/openstack/keystone/commit/bff03b5726fe5cac93d44a66715eea49b89c8cb0 · Note
• https://github.com/openstack/keystone/commit/d5378f173da14a34ca010271477337879002d6d0 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/keystonemiddleware/PYSEC-2016-20.yaml · Note
• https://github.com/openstack/keystonemiddleware/commit/96ab58e6863c92575ada57615b19652e502adfd8 · Note